whitehat-security/SCOPE.md

Scope

One-liner

whitehat-security is NetKingdom's authorization-bound offensive-security tooling for producing adversarial evidence about security claims.

Core idea

The repository turns stated security properties into dated, reproducible attack attempts. It remains separate from the systems it tests, reports findings without grading their severity, and never treats a passing probe as proof that a boundary always holds.

In scope

• Attacker models for tenant isolation, credential confinement, noisy-neighbour behavior and erasure verification.
• Differential probes that compare behavior across controlled tenant contexts.
• Known-bad and known-good fixtures that demonstrate every probe can fail.
• Rules of engagement, target authorization, engagement records, abort controls and evidence minimization.
• Probe cadence and the resulting assurance/exposure window.
• Delivery of findings and passing-run evidence to risk-nexus.

Out of scope

• Fixing defects in target repositories.
• Assigning severity, disclosure policy or remediation deadlines.
• Replacing mechanical checks owned by a target repository's CI.
• Defining the estate's security model or publishing permanent policy.
• Probing any target without the authorization and engagement records required by the rules of engagement.
• Blocking build-mode delivery without a separately recorded decision.

Safety invariants

• The rules of engagement are accepted, but their acceptance authorizes no live target. Without a complete approved engagement record, only documentation and non-networked fixture design may proceed.
• No live target is authorized by this scope document.
• Every live run names its authorization, target, owner, window, technique, credential lane, rate ceiling, abort contact and finding destination.
• A probe stops at the recorded boundary and never follows an adjacent system.
• Evidence records response shape and counts, never real tenant row values or credentials.
• Findings leave this repository; repairs do not enter it.

Relevant when

• A service claims a Tenancy Posture evidence level that requires adversarial rather than mechanical evidence.
• A boundary must be tested using a leaked runtime credential or hostile tenant context.
• The estate needs to know when a probe last ran, what attacker it modeled, and whether it was proven against a known-bad fixture.

Not relevant when

• A repository needs unit, schema or provisioning tests for its own code.
• A finding needs triage, severity or disclosure handling; use risk-nexus.
• Permanent policy needs publication; use policy-nexus.
• The desired activity falls outside an approved engagement boundary.

Current state

• Repository status: active.
• Layer: Staff (declared in INTENT.md, 2026-09-01). WHITEHAT-IN-0001 is closed.
• Finished: WHITEHAT-WP-0001 through WHITEHAT-WP-0005 and WHITEHAT-WP-0007. Residual live Tenancy Posture evidence is WHITEHAT-WP-0006. Residual live ASM is WHITEHAT-WP-0008. Both stay blocked after the 2026-10-04 recheck and the owner returns the same day. T01 still waits on rapp-postgres for an ordinary runtime identity. T02 still waits on an operator substrate window. T03 still waits on access-engine or a new audit-core engagement ID. Live ASM still waits on a surface owner, with T-06 on approval-engine and a consuming PEP. No packet is authorized.
• WHITEHAT-WP-0007 triaged Gate House ASM T-01…T-10. Live asm-tNN registrations remain pending. In-process fixture-asm-t01…t10 calibrations exist. That work authorized no live probe.
• WHITEHAT-WP-0001 T01–T08 are complete for every applicable target. audit-core has dated E2 pass WH-ENG-20260822-AUDIT-E2-03. tenant-engine E2 and platform-pg E3 stay not_applicable. flex-auth E2 and shared-substrate P1/P2 stay pending. Offline E2, E3 and P1/P2 harnesses fail known-bad and pass known-good in-process.
• -01, -02 and -03 are terminal. A later live run needs a new engagement ID, plane admission, and the approvals required by the rules of engagement. WHITEHAT-WP-0006 owns that work and authorizes no packet.
• WHITEHAT-WP-0009 is finished. The 0.2.1 record shows WH-KNOW-001 and WH-KNOW-002. A local 0.2.3 retest did not reproduce them. risk-nexus holds open RISK-F-0013, RISK-F-0014 and RISK-F-0015. emergent-security commit 19e7feb accepts the scoped review and the two library remediations, and leaves provider evidence and the informed-decision pin reconciliation in blocked EMERGENT-WP-0002. This plan authorizes no packet.
• WHITEHAT-WP-0010 is finished. It dispositions sealed knowledge 0.2.6, digest 8d1d6a9d, commit f65d0e64, from offline probes and the recorded 28-case corpus. It finds no unsafe effect and both named RISK-F-0015 routes on the fixture tokens. It does not close that finding, accept EMERGENT-WP-0002-T07, or re-pin informed-decision. On 2026-10-04 emergent-security commit 9f4530b accepted only that bounded review gate, and risk-nexus commit e1f006b recorded the observation. RISK-F-0015 stays open. It authorizes no packet.

Relationships

• Owner and security canon: net-kingdom.
• Finding intake, severity and disclosure: risk-nexus.
• Permanent publication: policy-nexus.
• Initial proposed target owners: tenant-engine, audit-core and flex-auth.

Getting oriented

1. Read INTENT.md for the durable purpose and ownership model.
2. Read the rules of engagement before any probe design or execution.
3. Read WHITEHAT-WP-0001 for the finished applicable-target artifacts, WHITEHAT-WP-0006 for unauthorized live Tenancy Posture residuals, and WHITEHAT-WP-0007 for finished ASM T-01…T-10 triage, and WHITEHAT-WP-0008 for unauthorized live ASM residuals.